Vulnerability Description
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. This vulnerability is fixed in 8.39.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nsa | Emissary | <= 8.38.0 |
Related Weaknesses (CWE)
References
- https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-hxf2ExploitVendor Advisory
FAQ
What is CVE-2026-35583?
CVE-2026-35583 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked f...
How severe is CVE-2026-35583?
CVE-2026-35583 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-35583?
Check the references section above for vendor advisories and patch information. Affected products include: Nsa Emissary.